topic Re: kvmode=json and field aliases in Getting Data In

kvmode=json and field aliases

rdownie — Wed, 17 Apr 2019 17:05:26 GMT

When using kvmode=json to carve fields, when I try to create a field alias to make the fields CIM compliant, they don't appear to take. I assume there is a precedence here. Is there a way to accomplish this while still having the fields initially extracted with kvmode?
Any help would be appreciated.
Thanks,
-Bob

Re: kvmode=json and field aliases

pruthvikrishnap — Wed, 17 Apr 2019 19:01:23 GMT

Hi RD,

I did face a similar issue before, i did force some required fields, which worked in my case.
https://answers.splunk.com/answers/562805/how-to-force-to-set-certain-fields-host-and-source.html

Re: kvmode=json and field aliases

woodcock — Thu, 18 Apr 2019 13:08:59 GMT

Are you saying, "I have complete control of the format of my logs which are in json format and I am adding field names that are CIM-compliant"? If so, then the only thing that could be wrong is that you're event is not fully-valid json but in that case it would not be some fields that are missing; it would be ALL fields.